last executing test programs: 1m10.85077308s ago: executing program 1 (id=153): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {0x10}, {}, {0x2, 0x1}}, [@qdisc_kind_options=@q_cbq={{0x8}, {0x1c, 0x2, [@TCA_CBS_PARMS={0x18, 0x1, {0x3, '\x00', 0x5, 0x2, 0x3, 0x8}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendto$packet(0xffffffffffffffff, &(0x7f0000000540)="f4", 0x1, 0x0, &(0x7f0000000240)={0x11, 0x16, r6, 0x1, 0x6, 0x6, @broadcast}, 0x14) 1m7.355855454s ago: executing program 0 (id=154): r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000006380)={0x2020}, 0x2020) 57.980912177s ago: executing program 0 (id=155): bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0xfffffffffffffd51, &(0x7f0000000000)='cgroup\x00'}, 0x30) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x28) unshare(0x3a070600) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x8502, 0x0) r1 = syz_socket_connect_nvme_tcp() ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r1, 0x8982, &(0x7f00000000c0)) write$sndseq(r0, &(0x7f00000005c0)=[{0x6, 0x0, 0x0, 0x0, @time={0x0, 0x5}, {0x5, 0x1}, {}, @ext={0x0, 0x0}}, {0x10, 0x0, 0xe, 0x0, @tick=0x1, {}, {}, @raw32={[0xb]}}, {0x0, 0x0, 0x0, 0x0, @tick=0x4, {}, {}, @queue={0x2, {0x2, 0x4}}}, {0x0, 0x0, 0x0, 0x0, @tick, {0x0, 0x4}, {0x0, 0x10}, @queue={0x0, {0x4, 0x8001}}}], 0x70) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='dctcp', 0x5) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r2, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r2, &(0x7f0000001b00)="a60ec703", 0x4, 0x20000045, &(0x7f0000000140)={0xa, 0x2, 0xffff, @loopback, 0x3}, 0x1c) r3 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0x4) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_int(r4, &(0x7f0000000040)='cpu.max\x00', 0x2, 0x0) pwritev(r5, &(0x7f0000000440)=[{&(0x7f0000000080)="51bc462dd326e00325f0de07f10d0ce683", 0x11}], 0x1, 0x80000001, 0x6) 56.276492743s ago: executing program 1 (id=156): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)=ANY=[], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r2}, 0x4) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x18, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70500001000000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='kfree\x00', r3}, 0x10) close(r1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 49.818497544s ago: executing program 0 (id=157): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000040)=0x2800, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000180)={'netdevsim0\x00', 0xd}) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[], 0x48) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r3}, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x810) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000380)={@cgroup, 0x6, 0x1, 0x6, &(0x7f00000001c0)=[0x0, 0x0, 0x0], 0x3, 0x0, 0x0, 0x0, &(0x7f00000005c0)}, 0x40) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r4, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0xfffd, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@newqdisc={0x78, 0x24, 0xd0f, 0x70bd2c, 0x25dfdbfb, {0x60, 0x0, 0x0, r4, {}, {0xffe0, 0xa}, {0x0, 0x10}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x52, 0x40, 0x7, 0x200, 0x101}, 0x1ff, 0x1, 0x7, 0x4, 0x7, 0x3, 0x13, 0x14, 0x0, 0x4, {0x4, 0xffff, 0xb9, 0xe0000000, 0x8000, 0x73d34e52}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x2}, 0x4000) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0xffffff1f}], 0x1}, 0x0) 49.295300661s ago: executing program 1 (id=158): sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x10d, &(0x7f0000000380)={0x0, 0x0, 0x80, 0x0, 0x4000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000440)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_SHUTDOWN={0x22, 0x9}) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x4, 0xb, 0x4, 0x0, &(0x7f0000048000), 0x0) 38.245587956s ago: executing program 0 (id=159): mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f00000005c0)={0x1c, 0x25, 0x1, 0x70bd2a, 0x25dfdbfe, {0xb}, [@nested={0x8, 0xe, 0x0, 0x1, [@nested={0x4, 0x7e}]}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000004) r1 = userfaultfd(0x80001) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount(&(0x7f0000000240)=@nbd={'/dev/nbd', 0x0}, 0x0, &(0x7f00000000c0)='nfs\x00', 0x8004, 0x0) chdir(&(0x7f0000000140)='./file0\x00') r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f5, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) ioctl$TCSETSF2(r3, 0x402c542d, 0x0) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, &(0x7f0000000280)={0x24, 0x0, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="00220f0000000b2e2b5aa40bf85edaca83"], 0x0}, 0x0) r5 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r5, 0xc018480b, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) 36.571241999s ago: executing program 1 (id=160): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {0x10}, {}, {0x2, 0x1}}, [@qdisc_kind_options=@q_cbq={{0x8}, {0x1c, 0x2, [@TCA_CBS_PARMS={0x18, 0x1, {0x3, '\x00', 0x5, 0x2, 0x3, 0x8}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40098}, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r5, &(0x7f0000000540)="f4", 0x1, 0x0, &(0x7f0000000240)={0x11, 0x16, 0x0, 0x1, 0x6, 0x6, @broadcast}, 0x14) 21.020275427s ago: executing program 1 (id=161): r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00'}) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000140)=0x10000, 0x4) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f00000001c0)=0x100, 0x4) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000440)=0x400, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000180)={'batadv_slave_0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) bind$xdp(r2, &(0x7f0000000100)={0x2c, 0x0, r4}, 0x10) 14.358430323s ago: executing program 0 (id=162): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)=ANY=[], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r2}, 0x4) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x18, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70500001000000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='kfree\x00', r3}, 0x10) close(r1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) mbind(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0xa002, &(0x7f0000000140)=0x20000, 0x61, 0x5) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 4.384860873s ago: executing program 0 (id=163): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x1c0) r0 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000200)={0x100, r1}, 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file0/file0\x00', 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000280)={0x100, r2}, 0x0) close(r2) close(r1) umount2(&(0x7f00000002c0)='./file0\x00', 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000340)={0x100, r3}, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) landlock_restrict_self(r0, 0x0) close(r0) mknodat(0xffffffffffffff9c, &(0x7f0000000380)='./file1/file0\x00', 0x81c0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000003c0)='./file2\x00', 0x81c0, 0x0) 0s ago: executing program 1 (id=164): futex(&(0x7f000000cffc)=0x4, 0xb, 0x4, 0x0, &(0x7f0000048000), 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:6568' (ED25519) to the list of known hosts. syzkaller login: [ 508.916316][ T3191] cgroup: Unknown subsys name 'net' [ 509.714984][ T3191] cgroup: Unknown subsys name 'cpuset' [ 509.941584][ T3191] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 596.140449][ T3191] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 728.976457][ T3205] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 729.615695][ T3205] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 729.689244][ T3208] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 730.232116][ T3208] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 742.750716][ T3205] hsr_slave_0: entered promiscuous mode [ 742.804812][ T3205] hsr_slave_1: entered promiscuous mode [ 747.935887][ T3208] hsr_slave_0: entered promiscuous mode [ 748.013815][ T3208] hsr_slave_1: entered promiscuous mode [ 748.056457][ T3208] debugfs: 'hsr0' already exists in 'hsr' [ 748.062092][ T3208] Cannot create hsr debugfs directory [ 755.873209][ T3205] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 756.994053][ T3205] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 757.223846][ T3205] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 757.434388][ T3205] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 760.002712][ T3208] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 760.099519][ T3208] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 760.260044][ T3208] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 760.411370][ T3208] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 779.511264][ T3205] 8021q: adding VLAN 0 to HW filter on device bond0 [ 782.555985][ T3208] 8021q: adding VLAN 0 to HW filter on device bond0 [ 842.551035][ T3208] veth0_vlan: entered promiscuous mode [ 843.511771][ T3208] veth1_vlan: entered promiscuous mode [ 848.684217][ T3208] veth0_macvtap: entered promiscuous mode [ 850.431250][ T3208] veth1_macvtap: entered promiscuous mode [ 850.993459][ T3205] veth0_vlan: entered promiscuous mode [ 852.701078][ T3205] veth1_vlan: entered promiscuous mode [ 856.754769][ T1992] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.804586][ T1992] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.951930][ T1992] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.974158][ T1992] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 859.973500][ T3205] veth0_macvtap: entered promiscuous mode [ 861.363623][ T3205] veth1_macvtap: entered promiscuous mode [ 865.224879][ T3208] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 865.387724][ T1992] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 865.431435][ T3718] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 865.605344][ T3718] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 865.654497][ T3718] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 885.463474][ T3194] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 886.201691][ T3194] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 886.204968][ T3194] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 886.207131][ T3194] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 886.237154][ T3194] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 886.246019][ T3194] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 886.615193][ T3194] usb 1-1: config 0 descriptor?? [ 890.181817][ T3194] plantronics 0003:047F:FFFF.0001: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 890.602056][ T3194] usb 1-1: USB disconnect, device number 2 [ 901.247375][ T3857] veth0_to_team: entered promiscuous mode [ 1109.483099][ T3978] Zero length message leads to an empty skb [ 1111.706989][ T3978] netlink: 8 bytes leftover after parsing attributes in process `syz.0.29'. [ 1111.773946][ T3978] netlink: 8 bytes leftover after parsing attributes in process `syz.0.29'. [ 1111.776913][ T3978] netlink: 8 bytes leftover after parsing attributes in process `syz.0.29'. [ 1123.282012][ T3981] netlink: 8 bytes leftover after parsing attributes in process `syz.0.31'. [ 1123.283628][ T3981] netlink: 8 bytes leftover after parsing attributes in process `syz.0.31'. [ 1178.011301][ T4012] xt_l2tp: missing protocol rule (udp|l2tpip) [ 1217.443391][ T4035] netlink: 'syz.1.46': attribute type 12 has an invalid length. [ 1234.363653][ T4044] netlink: 'syz.0.49': attribute type 1 has an invalid length. [ 1348.412982][ T31] audit: type=1326 audit(1346.780:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4083 comm="syz.0.58" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0xdc02e code=0x7ffc0000 [ 1348.551121][ T31] audit: type=1326 audit(1346.940:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4083 comm="syz.0.58" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0xdc02e code=0x7ffc0000 [ 1369.116853][ T4094] process 'syz.0.62' launched './file1' with NULL argv: empty string added [ 1406.536460][ T4111] lo speed is unknown, defaulting to 1000 [ 1406.586069][ T4111] lo speed is unknown, defaulting to 1000 [ 1406.674678][ T4111] lo speed is unknown, defaulting to 1000 [ 1406.974475][ T4111] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 1407.624023][ T4111] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 1410.545860][ T4111] lo speed is unknown, defaulting to 1000 [ 1410.777759][ T4111] lo speed is unknown, defaulting to 1000 [ 1412.491558][ T4115] hsr0: entered promiscuous mode [ 1416.646079][ T4113] hsr0: left promiscuous mode [ 1437.612229][ T4135] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1451.315131][ T4147] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 1500.791548][ T3818] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 1501.161229][ T3818] usb 1-1: Using ep0 maxpacket: 32 [ 1501.391322][ T3818] usb 1-1: config 0 has an invalid interface number: 85 but max is 0 [ 1501.393673][ T3818] usb 1-1: config 0 has no interface number 0 [ 1501.395647][ T3818] usb 1-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1501.422012][ T3818] usb 1-1: config 0 interface 85 has no altsetting 0 [ 1501.745620][ T3818] usb 1-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 1501.770631][ T3818] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1501.774991][ T3818] usb 1-1: Product: syz [ 1501.777254][ T3818] usb 1-1: Manufacturer: syz [ 1501.840748][ T3818] usb 1-1: SerialNumber: syz [ 1502.486798][ T3818] usb 1-1: config 0 descriptor?? [ 1509.355642][ T3818] appletouch 1-1:0.85: Failed to request geyser raw mode [ 1509.384447][ T3818] appletouch 1-1:0.85: probe with driver appletouch failed with error -5 [ 1520.211955][ T3818] usb 1-1: USB disconnect, device number 3 [ 1531.493722][ T4201] mmap: syz.0.87 (4201) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 1594.236418][ T4230] veth0_to_team: entered promiscuous mode @   /dev/fusefd=0x0000000000000004,rootmode=00000000000000000040000,user_id=00000000000000000000,group_id=00000000000000000000P)@s./file0/file0./file0fuse.file0ރm#։!f۪y&jAcaAC|D9 ^瀘hyfH8fC2l%S`-$mRFZ|H7M[ >Q,EGXIQ5J?V9g4aS3% FhM^6)Q7:L]>]bHYv€r8`)5ݺŦ.=W&W!s.)#>01A'^䮅nȈgQR~UvCD/p%E:b& Zq`CJjM37`xl!Xۀv`6o{FН,gIKL,gPe[^++ǀ bQ=䌸+?0?Znv?60EFy#H5LⅯ unK"qYBfQdiq kxcK]۠y18_MQAİ"Ϸ RUZWlˌ[dtgvb-Bl\[;ΑŏqM?Xdr ]O "?]:n6Sq\R`V U]Q\@|ή)tP3H8dh.gjo9j|:5yX566 ڔX$ogX?q=w2H*xxBaubrx;21#[v#U~vv'1A T!kmzMxqFQe[ԙcS[K@|ZYŸ 'ĩÊU^B0Sd ;޻p) 5G~M(ylU ou&&3+ 1u䦗fCU-mΖQ0qD"^._g|t>ˊ6y#!rb6hԘki$әhN.v^wkXȔn; 6#< ޏ*t\^M9y [qU7f!:; Nѫ.a w*uU@m`K|0e)^ޔ8c~)$Kt^x,Q ;*5'e\ݖ~sq :,D)0RP=1HT{OM,᐀x(P6M4>s~z͡]y"inkP&;t(v>%`lOsZO6qԑ]8G\{E_Q;CLa M&Fn67I4W֘E-&xܥKJR[hCB:n 8ȿAr'J4-g qĕQQo!˱&]sLr])U;:y]-`Bxo rI?ǒvCfJ52 о j$l6Wƹ܃zCީH`cs̄"M3"Bȕ@uqg86ʹaUj`dfSEz֮"IFBxH`"s٠ϠڎrG^ND(7QI4G>ն>@HMUK?.x?L:5dPU:}"BWXYyTՌt*lv2knRsd$MC?ȁ? *$3Ij{ E* r=ڏem!{U4+\<|뻝OLf]EMҋ!~a1x^ڼH&q}ZX6;K9/PHto^FPByF FN9SM3Ke5)h* mF/.X{7.b!HqqW]Dž^zg1ZFhd`ڷjc̀&:IUkHz X_-LAFg|J,K^Jtk~oKqKp(I (wk¨|ao 2G?';[:@Ic}̼/ zfq|YlV h^ޖ{>拌YVL;k,X8~08,QEe QkyVj g?ت`w7WIDQzh$PFG$wʆbAr"mf+$>]ܨ(|WQ @,6 4}KI^/xɥ;cd>dGnh[;-͉<hhI&}o+N{iu*Jgh4/B$|R|+ `dPz-&7YF*hh C㖹t5a%GТ'7 6oCKI/]b0|6oԅ|@IXqU5/R$mF.p2vdMŘo'?9Q!B@EƼ6bs <'C"L5p})dn u|eM;)oz$VQ6*YVZƱث̔Ƴ;1OnP`WdU]O@,~%ˤ"9IXuC:"\BwFv}z:Je:f?*;&^i"pX*K\!,4_O~$fOs|`gd_]KlFK<~rŵˮsd!<F׸ln;^(+|n{Ѱ!0̯zY)Qdut<]ɁK;%bGy50~nÀ q0³UHSIVS%sn|$\)Z=^:ra(5 j0) u=u)-+6iY ^@}ދĖq#&jvk@$a)gmGwBn>Im.q(r֮3 yȶNز L,K 0K{ݜf@"0Al_~A)GRa?J((HR̫.axzݨ<wH׵$8HC-Y.aq,/qC*#IU$@#44L{j/''dϕxF.;>bCZg^%65ߪh>օA?[Q ЦFt,娇FLF $Q-(՗. I۾gc"N2;ԽTDR.#14>fbj:r^C9`@#|K^tӮ|DVpT7q,nQc*LMoÄ#ո( 5Ad*kpPPu/OkC߃ h*ogzL[;{cʦ{q1UU,q88a] {%Js?%&3b]=C K{Z ;6 {5y, _ u(;8\ rB^Q D<^Ő؝`t* ,/E}] kO].ox"VO/N^^1e7LΎxrc8'g0b;*p!qzKqKr9ľ ]9d4A ;Mgz8ke=ݮ[0ג>4!Y!)d]n!]SkNb:C^ A K,I{~>✌ &d66LHQOU6$A\_704x¬;E(O| } 76%8gTtwyMfJ'dsuc0LlIdThR3JVXDA|u ;hhkVmw%0&q;ɑ3̼'7AoRB :Fj O-м/Ƕ6(~h-s[ 1654.404753][ T4261] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 1682.341648][ T4274] syz_tun: entered allmulticast mode [ 1682.672865][ T4274] syz_tun: left allmulticast mode [ 1699.596397][ T4281] syz.1.108 uses obsolete (PF_INET,SOCK_PACKET) [ 1700.684515][ T4281] syzkaller1: entered promiscuous mode [ 1700.687080][ T4281] syzkaller1: entered allmulticast mode [ 1720.971304][ T4288] netlink: 'syz.1.110': attribute type 4 has an invalid length. [ 1763.467395][ T4307] syzkaller0: entered promiscuous mode [ 1763.505320][ T4307] syzkaller0: entered allmulticast mode [ 1791.205559][ C0] vcan0: j1939_tp_rxtimer: 0xffffaf801d3c8000: rx timeout, send abort [ 1791.223537][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffffaf801d3c8000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 1860.617632][ T4357] netlink: 4 bytes leftover after parsing attributes in process `syz.0.134'. [ 1866.287466][ C0] vcan0: j1939_tp_rxtimer: 0xffffaf801cfc8400: rx timeout, send abort [ 1866.294555][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffffaf801cfc8400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 1872.760424][ T4372] netlink: 24 bytes leftover after parsing attributes in process `syz.1.137'. [ 1896.092336][ C1] vcan0: j1939_tp_rxtimer: 0xffffaf801cfc8400: rx timeout, send abort [ 1896.103556][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffffaf801cfc8400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 1934.085010][ C1] vcan0: j1939_tp_rxtimer: 0xffffaf8019e1d000: rx timeout, send abort [ 1934.096819][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffffaf8019e1d000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 1998.201105][ T4443] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 2013.261896][ T3817] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 2013.712163][ T3817] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2013.714848][ T3817] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 2013.716335][ T3817] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 2013.717511][ T3817] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 2013.752985][ T3817] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 2013.755404][ T3817] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2014.265169][ T3817] usb 1-1: config 0 descriptor?? [ 2018.604631][ T3817] plantronics 0003:047F:FFFF.0002: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 2019.712909][ T3817] usb 1-1: USB disconnect, device number 4 [ 2045.872648][ T4483] BUG: sleeping function called from invalid context at fs/inode.c:1928 [ 2045.876947][ T4483] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4483, name: syz.0.163 [ 2045.882992][ T4483] preempt_count: 1, expected: 0 [ 2045.885502][ T4483] RCU nest depth: 0, expected: 0 [ 2045.892273][ T4483] 2 locks held by syz.0.163/4483: [ 2045.894557][ T4483] #0: ffffaf801f3d60e0 (&type->s_umount_key#57){+.+.}-{4:4}, at: deactivate_super+0x7e/0x98 [ 2045.906926][ T4483] #1: ffffaf801f3d6998 (&s->s_inode_list_lock){+.+.}-{3:3}, at: hook_sb_delete+0x12e/0xbde [ 2045.916978][ T4483] Preemption disabled at: [ 2045.917819][ T4483] [] hook_sb_delete+0x12e/0xbde [ 2045.925825][ T4483] CPU: 1 UID: 0 PID: 4483 Comm: syz.0.163 Not tainted syzkaller #0 PREEMPT [ 2045.927177][ T4483] Hardware name: riscv-virtio,qemu (DT) [ 2045.927902][ T4483] Call Trace: [ 2045.928546][ T4483] [] dump_backtrace+0x2e/0x3c [ 2045.929459][ T4483] [] show_stack+0x30/0x3c [ 2045.930027][ T4483] [] dump_stack_lvl+0x12a/0x1a2 [ 2045.930893][ T4483] [] dump_stack+0x1c/0x24 [ 2045.931660][ T4483] [] __might_resched+0x59c/0x5f8 [ 2045.932326][ T4483] [] __might_sleep+0x86/0xca [ 2045.932980][ T4483] [] iput+0x3c/0xb22 [ 2045.933875][ T4483] [] hook_sb_delete+0x86e/0xbde [ 2045.934674][ T4483] [] security_sb_delete+0xac/0x184 [ 2045.935523][ T4483] [] generic_shutdown_super+0xba/0x37c [ 2045.936420][ T4483] [] kill_litter_super+0x74/0xb0 [ 2045.937300][ T4483] [] deactivate_locked_super+0xd8/0x19c [ 2045.938353][ T4483] [] deactivate_super+0x84/0x98 [ 2045.939254][ T4483] [] cleanup_mnt+0x1dc/0x3e6 [ 2045.940071][ T4483] [] __cleanup_mnt+0x1c/0x26 [ 2045.941380][ T4483] [] task_work_run+0x16a/0x25e [ 2045.941917][ T4483] [] exit_to_user_mode_loop+0x110/0x142 [ 2045.942492][ T4483] [] do_trap_ecall_u+0x3f8/0x53a [ 2045.943256][ T4483] [] handle_exception+0x15e/0x16a SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 2075.562459][ T4435] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0